Is Street View Maps safe?
Street View Maps renders remote HTML from its own server into the new tab page without sanitization and transmits every search keystroke to its server.
On each new tab load, the extension fetches HTML from streetviewmaps.net and injects it directly via dangerouslySetInnerHTML in a privileged chrome-extension:// context, with no sanitization. Every character typed into the search box is sent to the operator's autosuggest endpoint before the user submits a query. On first use or when local storage is cleared, completed searches are also routed through the operator's own search endpoint rather than the user's default search engine.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New tab search box sends each keystroke to streetviewmaps.net
Typing in Street View Maps' new-tab search box sends the text so far to streetviewmaps.net on every keystroke, for autocomplete.
Confirmed: typed strings appeared verbatim in q= on requests to .../public/autosuggest, with no debounce.
What actually happens
You type a search term into the box on a new tab page.
Each character you add updates the input value the extension tracks.
The extension sends what you have typed so far to streetviewmaps.net to fetch suggestions.
Both the small top-bar search and the main search box make their own request on every change to the text.
Captured request
JSON suggestion results under a gossip.results array. A second typed value was observed the same way at https://streetviewmaps.net/extension/public/autosuggest?q=mysearchterm123, with the typed text carried verbatim in the q= parameter each time.
What is sent in the request
- Your search textq=canaryquery
Whatever you've typed into the new-tab search box so far, sent each keystroke. Search terms can reveal interests, intentions, and locations.
The code that does this
The keystroke-bound effects that issue the request
Top-bar search: useEffect on the input value a calls the autosuggest endpoint
useEffect(() => { fetchTopbarSuggestions("topbar");}, [a]); // a = current text in the top-bar search inputfunction fetchTopbarSuggestions() { if (a.length === 0) { ee([]); return; } // jQuery $.getJSON — one request per change to `a`, no debounce $.getJSON( "https://streetviewmaps.net/extension/public/autosuggest?q=" + encodeURIComponent(a), (resp) => { if (!resp.toString().includes("Server Error:")) { renderResults(resp.gossip.results); } } );}Main search: useEffect on the input value a calls the same endpoint
useEffect(() => { if (a.length === 0) { setResults([]); return; } // axios .get — one request per change to `a`, no debounce axios .get("https://streetviewmaps.net/extension/public/autosuggest?q=" + encodeURIComponent(a)) .then((resp) => { const data = resp.data; if (!data.toString().includes("Server Error:")) { setResults(data.gossip.results); } }) .catch((e) => console.log(e));}, [a]); // a = current text in the main search inputWhat it can do
Permissions this extension asks for, as declared in version 1.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Run searches with your default search engine
search
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Street View Maps contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- streetviewmaps.net
Street View Maps sends data to streetviewmaps.net. No other extension we have analyzed sends data here.